FortiOS upgrades: managing FortiGate vulnerabilities safely

The short answer: a FortiGate is upgraded methodically, neither in permanent emergency mode nor by neglect. You need to follow Fortinet PSIRT advisories, choose a mature FortiOS release suited to the model, follow the official upgrade path without skipping steps, read the release notes, back up the configuration, then work within a maintenance window with a rollback plan. When a critical flaw is being exploited, you apply the published workaround immediately, and the upgrade follows as soon as possible.

Initial firmware setup is part of our 10 security settings after installing a FortiGate. This article covers what comes next: managing vulnerabilities over time. At ALLSAFE SOLUTIONS, a Fortinet integrator in Morocco, this is a task we carry out continuously for the FortiGates we manage, in Casablanca and across Morocco. The facts cited come from FortiGuard and Fortinet’s official documentation.

Why firewalls are prime targets

A firewall is exposed to the internet by nature: VPN interface, sometimes the administration interface, published services. A flaw in this appliance gives an attacker direct access to the network, without going through a workstation. That is why vulnerabilities in security appliances, across all brands, are exploited very quickly after publication.

Three advisories published by Fortinet on its PSIRT portal illustrate the point:

FortiGuard advisory	CVE	Nature	What Fortinet says
FG-IR-22-398	CVE-2022-42475	Heap-based buffer overflow in the SSL VPN service (sslvpnd)	Critical severity, CVSSv3 score 9.8; Fortinet was aware of an instance of exploitation
FG-IR-24-015	CVE-2024-21762	Out-of-bound write in the SSL VPN service (sslvpnd)	Critical severity, CVSSv3 score 9.8; potentially exploited; workaround: disable SSL VPN, as disabling web mode alone is not a valid workaround
FG-IR-24-535	CVE-2024-55591	Authentication bypass affecting the administration interface	Critical severity, CVSSv3 score 9.8; exploitation reported; FortiOS 7.0.0 to 7.0.16 affected, fixed in 7.0.17

These advisories show two constants. Internet-facing services, SSL VPN and the administration interface first, concentrate the most serious flaws. And each advisory gives an immediate workaround in addition to the fix. This is not specific to Fortinet: all firewall vendors regularly publish comparable advisories. What makes the difference is how quickly the operator reacts.

Following Fortinet PSIRT advisories

Fortinet’s PSIRT policy sets a clear schedule:

• a monthly advisory, published on the second Tuesday of each month;
• out-of-cycle advisories for critical vulnerabilities, when necessary;
• possibly earlier publication when Fortinet observes active exploitation, sometimes before all fixes are available.

For alerts, Fortinet offers an RSS feed of advisories and email registration through its support portal. The fortiguard.com/psirt portal lets you filter by product and severity. We recommend reading not only the title, but also the affected versions, the fixed versions and the proposed workaround.

For each new advisory, we ask four questions: is the installed product and version affected? Is the vulnerable feature enabled, or exposed to the internet? Is there known exploitation? Can a workaround be applied today? The answers set the response time.

Prioritisation then depends on context. A critical flaw in SSL VPN matters little if SSL VPN is disabled and the administration interface is closed to the internet; a moderate flaw in a feature exposed to everyone may deserve faster action. That is why we keep, for each FortiGate we manage, an up-to-date record of its version, its enabled features and the services it exposes: when an advisory is published, the answer to “are we affected?” comes quickly, without a lengthy investigation. The same record also shows which appliances are approaching end of support, so replacements can be budgeted before they become urgent.

Choosing the right version: mature rather than newest

The newest version is not necessarily the best for a production firewall. A new major branch brings features, but also behaviour changes and, early on, issues fixed in later releases. A maintenance release of an established branch is generally safer.

Fortinet publishes on its technical community a recommended FortiOS release per FortiGate model, updated regularly. We cross-check it with the release notes and with the features the customer uses.

A new branch can also remove features. A notable example: from FortiOS 7.6.3, SSL VPN tunnel mode no longer exists, its settings are not converted, and web mode (renamed Agentless VPN) is not supported on the 40F, 60F and 90G series. An upgrade started without preparation cuts off remote workers. We detail the migration to IPsec in FortiClient VPN and ZTNA for remote work.

Finally, a FortiGate model reaching end of life eventually stops receiving new versions. If your appliance can no longer be patched, the question is no longer the upgrade but the replacement, covered in FortiGate licence renewal.

The official upgrade path

You cannot jump directly from any version to any other. Fortinet provides an Upgrade Path Tool in its documentation library: you enter the model, the current version and the target version, and the tool returns the sequence of intermediate versions to install. Release notes remind you that some direct upgrades from older versions are not supported. Fortinet also notes that these paths are updated from time to time: consult the tool at the time of the work, not an old screenshot.

Each intermediate step matters. The configuration is converted from one version to the next; skipping an unplanned step risks a badly converted rule, VPN or object, discovered by users the following day.

Preparing the work

Before any upgrade, we gather the following:

Item	Why
Configuration backup, stored off the appliance	To restore the exact previous state
Image of the current firmware	To return to the original version if needed
Release notes for each step	To spot removed features, changes and known issues
Official upgrade path	To skip no intermediate step
Compatibility of FortiClient, FortiSwitch, FortiAP and FortiClient EMS	To avoid a half-compatible network
Console or on-site access	To stay in control if the unit does not restart as expected
Post-upgrade test list	To check internet, VPN, telephony, critical applications
Approved maintenance window	To inform users and avoid business hours

For a high availability cluster, uninterruptible upgrade updates the secondary unit, fails traffic over to it, then upgrades the former primary, as explained in FortiGate high availability. It is one of the best arguments for a cluster in an environment that cannot stop.

When a critical flaw lands

Faced with a critical advisory with known exploitation, the order of operations changes:

1. Check exposure: installed version, affected feature enabled or not, reachable from the internet or not.
2. Apply the workaround published in the advisory, the same day: disable SSL VPN, restrict the administration interface to trusted addresses, disable the vulnerable feature.
3. Look for signs of compromise using the indicators published by Fortinet when available, and the firewall logs.
4. Plan the upgrade urgently, while still following the official path and taking a backup first.
5. Change passwords and review accounts if compromise cannot be ruled out.

One simple rule greatly reduces exposure to this type of flaw: the FortiGate administration interface must never be reachable from the internet. It is the first of the settings we apply.

The link with law 05-20 and the DGSSI

Morocco’s cybersecurity law 05-20 imposes security rules defined by the DGSSI on public entities, critical infrastructures and the operators concerned. It also provides a fine for any organisation whose system was used, without its knowledge, to spread malware or commit unlawful acts, if it fails to apply DGSSI directives after being informed. An unpatched firewall, compromised and then used as a relay, fits exactly this scenario. We detail these obligations in Morocco cybersecurity law 05-20 and the role of the DGSSI.

Mistakes we fix

1. A FortiGate never updated since installation, “because everything works”.
2. A direct upgrade to the latest version, with no intermediate path and no reading of release notes.
3. No configuration backup off the appliance, or a backup several months old.
4. The administration interface open to the internet, to make a one-off troubleshooting session easier and never closed again.
5. SSL VPN kept on an old version to avoid migrating to IPsec.
6. Work done in the middle of the day, without warning users or planning a rollback.
7. Nobody subscribed to PSIRT advisories: the flaw is discovered through the press, or by the attacker.

FortiOS upgrade checklist

• Read the PSIRT advisory and check whether the version and features in use are affected.
• Choose the target version, mature and suited to the model.
• Get the official upgrade path on the day of the work.
• Read the release notes for each step, especially removed features.
• Back up the configuration and current image, off the appliance.
• Approve the maintenance window and inform users.
• Upgrade step by step, then run the tests.
• Check compatibility of FortiClient, switches and access points.
• Record the work: versions, date, tests, issues.

How we work

We start with a free initial audit of your FortiGate: model, FortiOS version, PSIRT advisories that affect it, exposure of administration and VPN, state of backups. We then apply urgent workarounds and plan the upgrade along the official path, in a maintenance window agreed with you. As part of our managed IT services in Morocco, we follow every Fortinet advisory for the appliances we manage, firewalls are monitored 24/7, and critical incidents are handled in under 15 minutes.

Discover our approach to cybersecurity in Morocco, then request your free initial audit: we reply within 24 business hours.